Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Nagios can do SSL checking, but it doesn't actually check if the certificate is valid for the connection address you're using (common name match).

On one of our servers, a postfix configuration file was replaced by a Plesk update without notice, resulting in a regression to a snake-oil certificate. Nagios checks SSL, but didn't see it. To that end, I'd like to check more than just the expiration date, and actually check the CA chain.

I've tried several SSL plugins for nagios, but none of them can do it.

Does anybody have advice?

share|improve this question
up vote 5 down vote accepted

I don't have any experience with it but it looks like the check_ssl_cert plugin does what you are looking for.

Excerpt from the author's site:

check_ssl_cert is a Nagios plugin to check the CA and validity of an X.509 certificate

share|improve this answer
This seems to be one that does. I hadn't found it before. Thanks. I'm trying it now. – Halfgaar Oct 28 '11 at 9:09
Hmm, it works, but it only checks the common name, not the additional domains... – Halfgaar Oct 28 '11 at 10:03

I can't find a plugin that tests it, either, but it would be very easy to wrap some random GPLed plugin's guts around an openssl one-liner. Here's a one-liner comparing the output from two of my servers; www has an Equifax certificate on it, nagios is self-signed:

[madhatter@anni ~]$ echo "" | openssl s_client -connect |& grep "verify error"
verify error:num=18:self signed certificate
[madhatter@anni ~]$ echo $?
[madhatter@anni ~]$


[madhatter@anni ~]$ echo "" | openssl s_client -connect |& grep "verify error"
[madhatter@anni ~]$ echo $?
[madhatter@anni ~]$

note the nice, easy-to-test change in the exit status of grep, depending on whether or not it finds the "verify error" string.

How's that?

share|improve this answer

I've attempted to create a Nagios check to verify the chain order base on this method, but this method doesn't seem to work with Debian without changes. You should use:

echo "" | openssl s_client -showcerts -connect -CApath /etc/ssl/certs/ |& grep "verify error"

Furthermore, this does not work when the chain is in the wrong order, but still is present entirely.

You would say the order doesn't really care, as long as the intermediates are in the right order, but some systems require the root CA to be present, and some systems don't.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.